diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
index b054cf5..cf4c91c 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate)
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate auditd)
diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
index 8a7241f..1db0cfa 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl-barbican/init.yml
@@ -8,6 +8,7 @@
 - system.openssh.server.team.mcp_qa
 - cluster.virtual-mcp-pike-dvr-ssl-barbican.infra
 - cluster.virtual-mcp-pike-dvr-ssl-barbican.openstack
+- system.auditd.server.ciscat
 - cluster.overrides
 parameters:
   _param:
diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl/.env b/classes/cluster/virtual-mcp-pike-dvr-ssl/.env
index 3681e6f..ebce5d7 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl/.env
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd logrotate)
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd logrotate auditd)
diff --git a/classes/cluster/virtual-mcp-pike-dvr-ssl/init.yml b/classes/cluster/virtual-mcp-pike-dvr-ssl/init.yml
index 5b47776..048d300 100644
--- a/classes/cluster/virtual-mcp-pike-dvr-ssl/init.yml
+++ b/classes/cluster/virtual-mcp-pike-dvr-ssl/init.yml
@@ -9,6 +9,7 @@
 - system.openssh.server.team.mcp_qa
 - cluster.virtual-mcp-pike-dvr-ssl.infra
 - cluster.virtual-mcp-pike-dvr-ssl.openstack
+- system.auditd.server.ciscat
 - cluster.overrides
 parameters:
   _param:
diff --git a/classes/cluster/virtual-mcp-pike-dvr/.env b/classes/cluster/virtual-mcp-pike-dvr/.env
index 147f964..006f9e8 100644
--- a/classes/cluster/virtual-mcp-pike-dvr/.env
+++ b/classes/cluster/virtual-mcp-pike-dvr/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(fluentd git grafana linux nginx ntp openssh prometheus reclass rsyslog salt sphinx telegraf backupninja logrotate)
+FORMULAS_SALT_MASTER+=(fluentd git grafana linux nginx ntp openssh prometheus reclass rsyslog salt sphinx telegraf backupninja logrotate auditd)
diff --git a/classes/cluster/virtual-mcp-pike-dvr/init.yml b/classes/cluster/virtual-mcp-pike-dvr/init.yml
index cbf24f0..b3e79c6 100644
--- a/classes/cluster/virtual-mcp-pike-dvr/init.yml
+++ b/classes/cluster/virtual-mcp-pike-dvr/init.yml
@@ -8,6 +8,7 @@
 - system.openssh.server.team.mcp_qa
 - cluster.virtual-mcp-pike-dvr.infra
 - cluster.virtual-mcp-pike-dvr.openstack
+- system.auditd.server.ciscat
 - cluster.overrides
 parameters:
   salt:
diff --git a/classes/cluster/virtual-mcp-pike-ovs/.env b/classes/cluster/virtual-mcp-pike-ovs/.env
index 147f964..006f9e8 100644
--- a/classes/cluster/virtual-mcp-pike-ovs/.env
+++ b/classes/cluster/virtual-mcp-pike-ovs/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(fluentd git grafana linux nginx ntp openssh prometheus reclass rsyslog salt sphinx telegraf backupninja logrotate)
+FORMULAS_SALT_MASTER+=(fluentd git grafana linux nginx ntp openssh prometheus reclass rsyslog salt sphinx telegraf backupninja logrotate auditd)
diff --git a/classes/cluster/virtual-mcp-pike-ovs/init.yml b/classes/cluster/virtual-mcp-pike-ovs/init.yml
index 6d75499..6cc8a27 100644
--- a/classes/cluster/virtual-mcp-pike-ovs/init.yml
+++ b/classes/cluster/virtual-mcp-pike-ovs/init.yml
@@ -8,6 +8,7 @@
 - system.openssh.server.team.mcp_qa
 - cluster.virtual-mcp-pike-ovs.infra
 - cluster.virtual-mcp-pike-ovs.openstack
+- system.auditd.server.ciscat
 - cluster.overrides
 parameters:
   salt:
diff --git a/classes/system b/classes/system
index 7f8c2f3..0185ec6 160000
--- a/classes/system
+++ b/classes/system
@@ -1 +1 @@
-Subproject commit 7f8c2f32dfa4fee69d3b1dbe2ad2a1e7f32bdb1e
+Subproject commit 0185ec6c09e0563af761afc88977dda3461ea6f0